On your GMail account you have the option to add other POP3 accounts to automatically fetch mail from them; Google Mail Fetcher. When enabled you have to specify your username and password, and the mail fetcher will start to continuously get emails from the other account.

Is the password you prompted for saved as clear text, as it's used periodically by the service to connect to your other account? Is this safe?

closed as primarily opinion-based by Stephane, Xander, ThoriumBR, schroeder, Eric G Jul 9 '15 at 15:15

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    You'd have to ask google for the details (they won't tell you - or us - but you can ask). Obviously, they have to save the password and I strongly suspect that it is not saved in clear text but in a reversible encrypted form. Whether it's safe or not depends on the context. – Stephane Jul 9 '15 at 10:55
  • You can try to set up mail forwarding in your other mail accounts if you don't like that. – user23013 Jul 9 '15 at 15:15

The details of how Google implemented this functionality is unknown and proprietary to google so it isn't possible to answer your question completely. However, here are the high points:

  • Google will have to save your POP3 account password in their system. There is no way around this because POP3 has no is no standard way to delegate rights to a third-party server. Speculative: Google probably keeps this copy of your password encrypted in a reversible fashion in their database. I base this speculation on the company history of putting high emphasis on security.
  • Google servers will, indeed, periodically contact your POP3 server and download new messages from there. If you have checked the "Always use a secure connection (SSL) when retrieving mail" option, it will do so over a secure channel.
  • The safety of the system depends on the context. You're placing your POP3 account credentials in the hand of Google. Due to the nature of that information, it could potentially be subpoenaed by authority, stolen by an employee or otherwise leaked. Given Google track record in security, uncontrolled disclosure seems unlikely but definitely not impossible. On the other hand, by using this functionality, you're already trusting Google with the content of your email and with the capacity to impersonate you. It can be argued that, unless the credentials your handing out allow access to other resources and assuming you do force the use of TLS for password check, you're not extending the trust by much with the actual account password.
  • 2
    About your point "unless the credentials your handing out allow access to other resources": this is true for a lot of email services, including gmail, as your gmail password is also your google account password – BgrWorker Jul 9 '15 at 15:07
  • @SebastianoRoncato Definitely. In some cases (GMail-to-gmail being an exemple), there are ways to work around that and provide only partial delegation. In others, it is possible to create secondary credentials limited to some resources. Sometimes, it isn't possible and it's something that you have to take into consideration when you decide to use the feature. Overall, it's really something that only can be evaluated on case-by-case basis – Stephane Jul 9 '15 at 15:16

The question can't be answered by anyone other than google. You may want to ask them but I doubt they will give you a response. The only thing we can know for sure is that the passwords are not hashed because if they were then google would not be able to impersonate you to the mail server. So google is storing the passwords unhashed they may be stored as plain text in the db or they may be encrypted in the db but even if encrypted the server is able to decrypt it. An attacker on the server may compromise the credentials even if encrypted.

Depending on what the email account is used for this may not be a problem. You probably should not be using that account for confidential or secure information (you generally shouldn't be using email for that period) unless the information is encrypted prior to emailing (i.e. GPG).

  • "You probably should not be using that account for confidential or secure information" -- as pointed out by @SebastianoRoncato above, your Gmail passwd is also your passwd for every other Google service, though I suppose that POP3 doesn't need to know your 2-factor info. – Mike Ounsworth Jul 9 '15 at 15:17

The password should be transmitted in plain text, otherwise Google can't send requests to the third party mail server as this mail server expects the password to be in plain text.

Is this safe?

No, it is not!

Please note: Using POP3 to fetch your e-mail is also not considered secure as there is no transport layer protection. It is recommended to only use protocols that have transport layer protection with strong cipher suits.

POP3s would be a better way to retrieve your e-mail, although I doubt there is an option in the GMail configuration for this.

  • 4
    First, you don't know how google implements it. It could be safer on their server than on your local client. Second, POP3 can use TLS for transport security. As a matter of fact: it does indeed sends STARTLS when connecting to a POP3 server (I checked my logs) – Stephane Jul 9 '15 at 10:58
  • 3
    There also is an option when activating the mail fetching to enable or disable SSL Security, as specified on the link I provided: "Always use a secure connection (SSL) when retrieving mail", but I didn't include that in the question as transport layer security wasn't the point – BgrWorker Jul 9 '15 at 11:01
  • +1 for the "Always use a secure connection" – Jeroen Jul 9 '15 at 11:02
  • 2
    @Jeroen-ITNerdbox I didn't assumed: I checked: they do use STARTTLS to upgrade the connection to TLS if your server supports it. If it doesn't, then there is a bigger security issue than gmail server. – Stephane Jul 9 '15 at 11:03
  • 2
    This is irrelevant: your answer is still incorrect. – Stephane Jul 9 '15 at 11:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.